@nanobpm/nano-workforce 0.133.0 → 0.133.1

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.133.1](https://github.com/nanobpm/nano-workforce/compare/v0.133.0...v0.133.1) (2026-08-24)
+
+### Bug Fixes
+
+* **read-model:** migrate remaining terminal-edge readers to derived_status ([#503](https://github.com/nanobpm/nano-workforce/issues/503)) ([#508](https://github.com/nanobpm/nano-workforce/issues/508)) ([663f113](https://github.com/nanobpm/nano-workforce/commit/663f1135a79a14436565f2a6b2320ad62bb0db6b))
+
 ## [0.133.0](https://github.com/nanobpm/nano-workforce/compare/v0.132.0...v0.133.0) (2026-08-24)
 
 ### Features

package/app/featureReadModel.test.ts

@@ -10,12 +10,12 @@
 // emitted from the ONE `featureReadModel` declaration, which ALSO drives the TS via `fnFor`. This
 // suite therefore guards THREE things:
 //
-//   1. DRIFT GUARD — migration 076 embeds each derived column's SQL VERBATIM from
+//   1. DRIFT GUARD — migration 080 embeds each derived column's SQL VERBATIM from
 //      `featureReadModel.sqlSelectFor(...)`, so the checked-in VIEW cannot drift from the declaration.
 //   2. FRAMEWORK PARITY GUARD — `assertReadModelParity` proves the SQL and TS lowerings the ONE
 //      declaration compiles to agree (the role the old hand-written lockstep test played, now
 //      framework-owned).
-//   3. END-TO-END BEHAVIOUR on the REAL migration VIEW (076 applied to an in-memory DB): the full
+//   3. END-TO-END BEHAVIOUR on the REAL migration VIEW (080 applied to an in-memory DB): the full
 //      status × open-task matrix vs the model-derived oracle, the stale-stored-column ignore, the
 //      reconciler `status`-bypass, the #422 answered-escalation drift, and the page binding.
 import { readFileSync } from "node:fs";
@@ -31,11 +31,14 @@ import { deriveListBucket, deriveStage } from "./stage.ts";
 const MIG = (name: string) => readFileSync(fileURLToPath(new URL(`../db/migrations/${name}`, import.meta.url)), "utf8");
 const PAGE = (name: string) => JSON.parse(readFileSync(fileURLToPath(new URL(`../pages/${name}`, import.meta.url)), "utf8"));
 
-const MIGRATION_076 = "076_feature_read_model_declare_once.sql";
+const MIGRATION_LATEST = "081_feature_read_model_derive_terminal.sql";
 
 // The base `feature_runs` shape the VIEW reads, plus the `user_tasks` inbox (034) the `attention`
-// derivation `EXISTS`-reads. The stored derived columns are present precisely so the tests can seed
-// STALE values and prove the VIEW ignores them.
+// derivation `EXISTS`-reads, plus a stand-in for the managed `feature_runs__tracking` derived VIEW
+// (ADR-0065) the read model now reads its terminal-folded `derived_status` off. The stored derived
+// columns are present precisely so the tests can seed STALE values and prove the VIEW ignores them;
+// `derived_status_override` lets a test model the reconciler's derive edge (a terminated instance ⇒
+// `abandoned` while base `status` stays frozen).
 function viewDb(): DatabaseSync {
   const db = new DatabaseSync(":memory:");
   db.exec(
@@ -43,14 +46,23 @@ function viewDb(): DatabaseSync {
        feature_key TEXT PRIMARY KEY, repo TEXT, issue_number INTEGER, issue_url TEXT, title TEXT,
        base_branch TEXT, status TEXT, process_key TEXT, pr_key TEXT, converge INTEGER, auto_merge INTEGER,
        outcome TEXT, delivery_label TEXT, acknowledged_at TEXT, created_at TEXT, updated_at TEXT,
-       stage TEXT, stage_state TEXT, stage_skipped TEXT, attention TEXT, list_bucket TEXT);`,
+       stage TEXT, stage_state TEXT, stage_skipped TEXT, attention TEXT, list_bucket TEXT,
+       derived_status_override TEXT);`,
   );
   db.exec(
     `CREATE TABLE user_tasks (
        user_task_key TEXT PRIMARY KEY, element_id TEXT NOT NULL, subject_type TEXT NOT NULL,
        subject_key TEXT NOT NULL);`,
   );
-  db.exec(MIG(MIGRATION_076));
+  // Stand-in for the managed `feature_runs__tracking` VIEW urban provisions at mount: re-exports
+  // `feature_runs.*` plus the terminal-folded `derived_status` the read model (migration 080) reads. A
+  // test seeds `derived_status_override` to model the reconciler's derive edge; absent, it falls through
+  // to the base `status`, exactly as the real VIEW's `ELSE base.status` branch does.
+  db.exec(
+    `CREATE VIEW feature_runs__tracking AS
+       SELECT f.*, COALESCE(f.derived_status_override, f.status) AS derived_status FROM feature_runs f;`,
+  );
+  db.exec(MIG(MIGRATION_LATEST));
   return db;
 }
 
@@ -126,22 +138,22 @@ function parityDb(db: DatabaseSync): ParityDb {
   };
 }
 
-test("DRIFT GUARD: migration 076 embeds each derived column VERBATIM from featureReadModel.sqlSelectFor (the VIEW cannot drift from the declaration)", () => {
-  const sql = MIG(MIGRATION_076);
+test("DRIFT GUARD: migration 080 embeds each derived column VERBATIM from featureReadModel.sqlSelectFor (the VIEW cannot drift from the declaration)", () => {
+  const sql = MIG(MIGRATION_LATEST);
   for (const col of FEATURE_READ_MODEL_DERIVED) {
     const emitted = featureReadModel.sqlSelectFor(col, { baseAlias: FEATURE_READ_MODEL_BASE_ALIAS });
     assert(
       sql.includes(`${emitted} AS ${col}`),
-      `migration ${MIGRATION_076} no longer embeds the declaration's SQL for "${col}" — regenerate it ` +
+      `migration ${MIGRATION_LATEST} no longer embeds the declaration's SQL for "${col}" — regenerate it ` +
         `from featureReadModel (or add a new superseding migration). Expected to contain:\n  ${emitted} AS ${col}`,
     );
   }
   // The VIEW is a DROP+CREATE that supersedes 073/075, and keeps every base column as an aliased
   // pass-through so the static pages↔schema contract guard still sees them.
-  assert(/DROP VIEW IF EXISTS feature_read_model;/.test(sql), "076 must DROP the superseded VIEW first");
-  assert(/CREATE VIEW feature_read_model AS/.test(sql), "076 must (re)create feature_read_model");
+  assert(/DROP VIEW IF EXISTS feature_read_model;/.test(sql), "080 must DROP the superseded VIEW first");
+  assert(/CREATE VIEW feature_read_model AS/.test(sql), "080 must (re)create feature_read_model");
   for (const base of ["feature_key", "status", "pr_key", "converge", "auto_merge", "acknowledged_at", "title", "repo"]) {
-    assert(sql.includes(`fr.${base} AS ${base}`), `076 must pass base column "${base}" through the VIEW`);
+    assert(sql.includes(`fr.${base} AS ${base}`), `080 must pass base column "${base}" through the VIEW`);
   }
 });
 
@@ -157,7 +169,11 @@ test("FRAMEWORK PARITY GUARD: featureReadModel's SQL and TS lowerings agree over
               const userTasks =
                 openTask && el !== null ? [{ subject_type: "feature", subject_key: "self", element_id: el }] : [];
               samples.push({
-                baseRow: { feature_key: "self", status, pr_key, converge, auto_merge, acknowledged_at },
+                // The status-classifying derivations read the tracking VIEW's terminal-folded
+                // `derived_status`; for a live (non-terminated) run it equals the base transient, so
+                // parity samples set it from `status`. (The parity guard's fixture table is named for the
+                // model's baseTable, `feature_runs__tracking`.)
+                baseRow: { feature_key: "self", status, derived_status: status, pr_key, converge, auto_merge, acknowledged_at },
                 projections: { user_tasks: userTasks },
               });
             }
@@ -172,7 +188,7 @@ test("FRAMEWORK PARITY GUARD: featureReadModel's SQL and TS lowerings agree over
   db.close();
 });
 
-test("the migration 076 VIEW derives stage/stage_state/stage_skipped/attention EXACTLY like deriveStage, over every status × converge/auto_merge/pr_key × open-task combination", () => {
+test("the migration 080 VIEW derives stage/stage_state/stage_skipped/attention EXACTLY like deriveStage, over every status × converge/auto_merge/pr_key × open-task combination", () => {
   const db = viewDb();
   const cases: Array<{ key: string; run: SampleRun; hasOpenBlockedTask: boolean; hasOpenEscalationTask: boolean }> = [];
   let i = 0;
@@ -217,7 +233,7 @@ test("the migration 076 VIEW derives stage/stage_state/stage_skipped/attention E
   }
 });
 
-test("the migration 076 VIEW derives list_bucket EXACTLY like deriveListBucket (history iff terminal AND acknowledged)", () => {
+test("the migration 080 VIEW derives list_bucket EXACTLY like deriveListBucket (history iff terminal AND acknowledged)", () => {
   const db = viewDb();
   let i = 0;
   const cases: Array<{ key: string; status: string; ackAt: string | null }> = [];
@@ -237,7 +253,7 @@ test("the migration 076 VIEW derives list_bucket EXACTLY like deriveListBucket (
   }
 });
 
-test("the migration 076 VIEW IGNORES any stale STORED projection columns — it reads only from status et al.", () => {
+test("the migration 080 VIEW IGNORES any stale STORED projection columns — it reads only from status et al.", () => {
   const db = viewDb();
   // A merged run whose STORED columns lie (frozen from when it was `running`). The VIEW must re-derive.
   addRun(db, "o/r#stale", {
@@ -312,6 +328,35 @@ test("RED/GREEN GUARD: a RAW-datasource feature_runs.status write (the instanceT
   assertEquals(row.list_bucket, deriveListBucket("abandoned", null));
 });
 
+test("RED/GREEN #503: a DERIVE-ONLY terminated run (base status frozen at 'running', derived_status='abandoned') renders Done/failed, not wedged 'Implementing'", () => {
+  // ADR-0065 (urban 0.81.0): cancel/terminate is DERIVE-ONLY — the reconciler feeds urban's projection
+  // and `feature_runs__tracking.derived_status` recomputes `abandoned` on READ; it does NOT write the
+  // terminal onto the base `feature_runs.status` column. So the base row stays frozen at its last
+  // transient (`running`) while the run is really terminated. Before 080 the read model classified off
+  // the frozen base `status` and rendered the dead run "Implementing" on the Feature history grid
+  // forever (the #503 phantom). 080 reads the terminal-folded `derived_status`, so it renders Done/
+  // failed with no worker write.
+  const db = viewDb();
+  // Seed a run whose engine instance was terminated out-of-band: base status still `running`, but the
+  // derive edge reports `abandoned` (modelled via the feature_runs__tracking stand-in's override).
+  addRun(db, "o/r#term", {
+    status: "running",
+    stored: { stage: "Implementing", stage_state: undefined, attention: "⚠", list_bucket: "active" },
+  });
+  assertEquals(projection(db, "o/r#term").stage, "Implementing", "precondition: the live transient renders Implementing");
+
+  db.prepare("UPDATE feature_runs SET derived_status_override = 'abandoned' WHERE feature_key = ?").run("o/r#term");
+
+  const row = projection(db, "o/r#term");
+  const oracle = deriveStage({ status: "abandoned", pr_key: null, converge: 0, auto_merge: 0 });
+  assertEquals(row.stage, "Done", "a derive-only terminated run is Done, not wedged at Implementing (the #503 phantom)");
+  assertEquals(row.stage, oracle.stage);
+  assertEquals(row.stage_state, "failed", "the derived terminal renders a FAILED state (was frozen NULL/Implementing)");
+  assertEquals(row.stage_state, oracle.state);
+  assertEquals(row.attention, null, "the stale ⚠ badge is gone once the run is terminated");
+  assertEquals(row.list_bucket, "active", "a just-cancelled run sits in Active until dismissed");
+});
+
 test("the Feature page binds the derived feature_read_model VIEW (not the raw feature_runs table)", () => {
   // `feature.page.json`'s runs grid is the ONLY thing making the UI consume the derived projection.
   const page = PAGE("feature.page.json");

package/app/featureReadModel.ts

@@ -47,20 +47,38 @@ export const STAGE_DONE_STATUSES: readonly string[] = ["merged", "converged", "b
  * promote this to the framework's canonical `urban_open_user_tasks` projection.) */
 export const USER_TASKS_PROJECTION = "user_tasks";
 
-/** `status IN (…)` as a closed-DSL predicate: an OR of equalities over the base row's `status`. */
-const statusIn = (...statuses: readonly string[]): Expr => or(...statuses.map((s) => eq(col("status"), lit(s))));
+/** The base table the read model reads: the auto-provisioned `feature_runs__tracking` derived VIEW
+ * (ADR-0065, urban 0.81.0), NOT the raw `feature_runs` table. The VIEW re-exports `feature_runs.*`
+ * plus a `derived_status` column that folds the `instanceTracking` reconciler's terminal edge
+ * (out-of-band terminate / in-app cancel → `abandoned`) over the worker-owned transient `status`. The
+ * status-classifying derivations below read `derived_status`, so a terminated run renders `Done`/
+ * `failed` instead of freezing at its last transient (`Implementing` forever — issue #503). The
+ * non-status base columns (`pr_key`/`converge`/`auto_merge`/`acknowledged_at`/`feature_key`) come off
+ * the same VIEW's pass-through of `base.*`. */
+export const FEATURE_READ_MODEL_BASE_TABLE = "feature_runs__tracking";
 
-/** The terminal tier — the row's `status` is one of the 6 `Done` statuses. */
+/** The effective-status column the status-classifying derivations read: the tracking VIEW's ADR-0065
+ * `derived_status` (terminal-folded), NOT the frozen base `status`. Single source of truth for the
+ * column name so the derivations can't drift from it. */
+export const EFFECTIVE_STATUS_COLUMN = "derived_status";
+
+/** `derived_status IN (…)` as a closed-DSL predicate: an OR of equalities over the tracking VIEW's
+ * terminal-folded effective status. */
+const statusIn = (...statuses: readonly string[]): Expr =>
+  or(...statuses.map((s) => eq(col(EFFECTIVE_STATUS_COLUMN), lit(s))));
+
+/** The terminal tier — the row's effective (terminal-folded) status is one of the 6 `Done` statuses. */
 const isDone: Expr = statusIn(...STAGE_DONE_STATUSES);
 
 /** The canonical pipeline `stage`. TOTAL over all 11 statuses. Terminal → `Done`; else `converging`
  * → `Converging`; else a raised PR (`pr_key` set, mirroring `(pr_key ?? "") !== ""`) or `opened` →
- * `PR open`; else a live/parked implementation status → `Implementing`; else `Requested`. */
+ * `PR open`; else a live/parked implementation status → `Implementing`; else `Requested`. Classifies
+ * on the terminal-folded `derived_status` so a cancelled/terminated run is `Done`, not frozen. */
 const stage: Expr = caseWhen(
   [
     when(isDone, lit("Done")),
-    when(eq(col("status"), lit("converging")), lit("Converging")),
-    when(or(neq(col("pr_key"), lit("")), eq(col("status"), lit("opened"))), lit("PR open")),
+    when(eq(col(EFFECTIVE_STATUS_COLUMN), lit("converging")), lit("Converging")),
+    when(or(neq(col("pr_key"), lit("")), eq(col(EFFECTIVE_STATUS_COLUMN), lit("opened"))), lit("PR open")),
     when(statusIn("running", "escalated", "awaiting_operator"), lit("Implementing")),
   ],
   lit("Requested"),
@@ -68,11 +86,12 @@ const stage: Expr = caseWhen(
 
 /** The active stage's render state in the `kind:"pipeline"` column's vocabulary: `ok` (merged/
  * converged), `blocked` (terminal blocked), `failed` (failed/skipped/abandoned), else NULL (in
- * progress). A pure function of `status`, so it is correct even for a parked/live status (NULL). */
+ * progress). A pure function of the terminal-folded `derived_status`, so a terminated run renders a
+ * terminal `failed` state instead of a frozen NULL. */
 const stageState: Expr = caseWhen(
   [
     when(statusIn("merged", "converged"), lit("ok")),
-    when(eq(col("status"), lit("blocked")), lit("blocked")),
+    when(eq(col(EFFECTIVE_STATUS_COLUMN), lit("blocked")), lit("blocked")),
     when(statusIn("failed", "skipped", "abandoned"), lit("failed")),
   ],
   lit(null),
@@ -136,7 +155,7 @@ export type FeatureReadModelDerivedColumn = (typeof FEATURE_READ_MODEL_DERIVED)[
  */
 export const featureReadModel: ReadModel = defineReadModel({
   name: "feature_read_model",
-  baseTable: "feature_runs",
+  baseTable: FEATURE_READ_MODEL_BASE_TABLE,
   selectBaseColumns: false,
   derive: {
     stage,

package/app/interEpicRegression.test.ts

@@ -18,6 +18,7 @@ import { resetDefaultBranchCache } from "./github.ts";
 import type { PlanDep } from "./plan.ts";
 import { EpicSetValidationError, validateEpicSet } from "./plan.ts";
 import { capabilityProbeForEdge, deriveEpicSchedule, lowerAdmittedSet } from "./planLowering.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import {
   type GithubRelease,
   matchCapability,
@@ -80,7 +81,7 @@ function makeApp(seedPlans: Record<string, unknown>[] = []) {
     };
   };
   const app = {
-    data: { table },
+    data: { table: withTrackingViews(table) },
     engine: {
       createInstance: (req: { processDefinitionId: string; variables?: Record<string, unknown> }) => {
         started.push(req);
@@ -210,7 +211,7 @@ function makeData() {
       return Promise.resolve({ processInstanceKey: `PI-${started.length}` });
     },
   } as unknown as EngineClient;
-  const data = { table } as unknown as DataLayer;
+  const data = { table: withTrackingViews(table) } as unknown as DataLayer;
   return { data, engine, tables, started };
 }
 

package/app/plan.test.ts

@@ -6,6 +6,7 @@
 // is not a positive integer, so the loop is always bounded.
 import { after, test } from "node:test";
 import { assertEquals, assertRejects, assertThrows } from "#test-assert";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import { positiveIntEnv } from "./plan.ts";
 
 const KEY = "NANO_PLAN_REVIEW_ROUNDS_TEST";
@@ -126,8 +127,8 @@ test("re-plan of a finished issue clears stale plan_reviews rows", async () => {
     plan_task_deps: { rows: [], key: "plan_key" },
   };
   const data = {
-    table: (name: string, key: string) =>
-      memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) =>
+      memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
   const engine = {
     createInstance: () => Promise.resolve({ processInstanceKey: "PI-1" }),
@@ -146,8 +147,8 @@ test("re-plan of a finished issue clears stale plan_reviews rows", async () => {
 
 function memData(stores: Record<string, { rows: any[]; key: string }>) {
   return {
-    table: (name: string, key: string) =>
-      memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key),
+    table: withTrackingViews((name: string, key: string) =>
+      memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
   } as any;
 }
 

package/app/plan.ts

@@ -21,6 +21,7 @@ import {
   fetchDefaultBranch,
   fetchIssueTitle,
 } from "./github.ts";
+import { derivedTrackingTable } from "./instanceTracking.ts";
 import { clearExclusions } from "./mergeExclusion.ts";
 import type { ReadinessProbe } from "./readiness.ts";
 import { clearTaskDeltas } from "./taskDelta.ts";
@@ -197,6 +198,17 @@ export type PlanTaskStatus = typeof PLAN_TASK_STATUSES[number];
  * offers Dismiss without a poller pass. The pure helpers stay the acknowledge-epic guard and the VIEW's
  * test oracle (app/plansReadModel.test.ts). */
 export const plans = (data: DataLayer) => data.table<Plan>("plans", "plan_key");
+/** A plan row as seen through its derived tracking VIEW (`plans__tracking`): the base columns plus
+ * urban's ADR-0065 `derived_status`, which folds the reconciler's terminal edge (out-of-band
+ * terminate / in-app cancel → `abandoned`) over the worker-owned transient. */
+type TrackedPlan = Plan & { derived_status: string };
+/** Read-only accessor over the plan derived tracking VIEW. Use this — and read `derived_status`, not
+ * `status` — for any terminal/active classification (the shared-base admission filter, the
+ * epic-admission idempotency gate), so an out-of-band-terminated epic (whose base row is still
+ * `planning`/`dispatched`) is correctly seen as `abandoned`. Worker-written terminals (`done`/
+ * `failed`) pass through unchanged. Writes stay on `plans`. */
+export const plansTracking = (data: DataLayer) =>
+  derivedTrackingTable<TrackedPlan>(data, "plans", "plan_key");
 export const planTasks = (data: DataLayer) => data.table<PlanTask>("plan_tasks", "id");
 
 /** One dependency edge in the plan DAG (issue #20): `task_id` waits for `depends_on_task_id`.
@@ -590,8 +602,12 @@ export async function findActivePlansByBase(
   repo: string,
   base: string,
 ): Promise<Plan[]> {
-  const rows = await plans(data).find({ repo, base_branch: base });
-  return rows.filter((p) => !PLAN_TERMINAL_STATUSES.some((s) => s === p.status));
+  const rows = await plansTracking(data).find({ repo, base_branch: base });
+  // ADR-0065: classify "active" on the DERIVED terminal edge, not the base transient — an epic whose
+  // engine instance was terminated out-of-band (or by an ordinary in-app cancel) keeps its base
+  // `status` frozen at `planning`/`dispatched` but reads `abandoned` on `plans__tracking.derived_status`.
+  // Reading the base `status` here counted a dead epic as ACTIVE and raised a false same-repo conflict.
+  return rows.filter((p) => !PLAN_TERMINAL_STATUSES.some((s) => s === p.derived_status));
 }
 
 /** Options gating the confirm-default (rule 3) and shared-base (rule 4) admission rules. Both
@@ -926,7 +942,14 @@ export async function startPlan(
   }
   const table = plans(data);
   const existing = await table.get(parsed.planKey);
-  if (existing && !PLAN_TERMINAL_STATUSES.some((s) => s === existing.status)) {
+  // ADR-0065: classify "already running" on the DERIVED terminal edge, not the base transient. An epic
+  // whose engine instance was terminated out-of-band (or by an ordinary in-app cancel — derive-only
+  // under urban 0.81.0) has a base row frozen at `planning`/`dispatched` but a
+  // `plans__tracking.derived_status` of `abandoned`; reading the base `status` here wedged a cancelled
+  // epic `alreadyRunning` (the `submitPr`-wedge twin). Route the idempotency gate through the derived
+  // view so a terminated epic is correctly seen terminal and RE-ADMITTABLE.
+  const trackedExisting = existing ? await plansTracking(data).get(parsed.planKey) : undefined;
+  if (trackedExisting && !PLAN_TERMINAL_STATUSES.some((s) => s === trackedExisting.derived_status)) {
     return { planKey: parsed.planKey, alreadyRunning: true };
   }
   const base = normalizeBaseBranch(baseBranch);

package/app/planLowering.test.ts

@@ -8,7 +8,7 @@ import { assert, assertEquals } from "#test-assert";
 import type { DataLayer, EngineClient } from "@nanobpm/urban";
 import type { PlanDep } from "./plan.ts";
 import { capabilityProbeForEdge, deriveEpicSchedule, lowerAdmittedSet } from "./planLowering.ts";
-
+import { withTrackingViews } from "../test/trackingViews.ts";
 const edge = (consumer: string, producer: string, pkg = "@scope/pkg", capRef = producer): PlanDep => ({
   plan_key: consumer,
   depends_on_plan_key: producer,
@@ -54,7 +54,7 @@ function makeData() {
       return Promise.resolve({ processInstanceKey: `PI-${started.length}` });
     },
   } as unknown as EngineClient;
-  const data = { table } as unknown as DataLayer;
+  const data = { table: withTrackingViews(table) } as unknown as DataLayer;
   return { data, engine, tables, started };
 }
 

package/app/plansReadModel.test.ts

@@ -34,19 +34,32 @@ function viewDb(): DatabaseSync {
        plan_key TEXT PRIMARY KEY, repo TEXT, issue_number INTEGER, issue_url TEXT, title TEXT,
        status TEXT, task_count INTEGER, process_key TEXT, outcome TEXT, created_at TEXT,
        updated_at TEXT, epic_phase TEXT, base_branch TEXT, wait_gate_label TEXT, bound_artifacts TEXT,
-       promotion_pr TEXT, promotion_state TEXT, acknowledged_at TEXT, list_bucket TEXT, ack_open INTEGER);
+       promotion_pr TEXT, promotion_state TEXT, acknowledged_at TEXT, list_bucket TEXT, ack_open INTEGER,
+       derived_status_override TEXT);
      CREATE TABLE plan_tasks (
        id INTEGER PRIMARY KEY, plan_key TEXT, task_index INTEGER, task_id TEXT, title TEXT,
        prompt TEXT, status TEXT, pr_key TEXT, summary TEXT, created_at TEXT, updated_at TEXT,
        wave INTEGER, open_question TEXT, answer TEXT, draft_pr_key TEXT, corr_key TEXT);
      CREATE TABLE pull_requests (pr_key TEXT PRIMARY KEY, url TEXT, status TEXT, process_key TEXT);`,
   );
+  // Stand-in for the managed `plans__tracking` VIEW urban provisions at mount (ADR-0065): re-exports
+  // `plans.*` plus the `derived_status` the terminal-edge reader (migration 079) reads. A test seeds
+  // `derived_status_override` to model the reconciler's derive edge (a terminated instance ⇒
+  // `abandoned` while base `status` stays frozen); absent, it falls through to the base `status`, exactly
+  // as the real VIEW's `ELSE base.status` branch does.
+  db.exec(
+    `CREATE VIEW plans__tracking AS
+       SELECT p.*, COALESCE(p.derived_status_override, p.status) AS derived_status FROM plans p;`,
+  );
   db.exec(MIG("059_plan_wave_summary.sql"));
   db.exec(MIG("060_plan_wave_rollup.sql"));
   db.exec(MIG("061_plan_delivery_rollup.sql"));
   // 074 redefines plan_read_model to DERIVE list_bucket/ack_open from status + acknowledged_at + the
   // derived plan_delivery signal (issue #439), instead of reading the denormalised base columns.
   db.exec(MIG("074_plan_read_model_derive_bucket.sql"));
+  // 079 re-points plan_read_model's status/bucket derivations at the derived plans__tracking VIEW so a
+  // terminated (derive-only `abandoned`) epic drops out of Active (issue #503).
+  db.exec(MIG("080_plan_read_model_derive_terminal.sql"));
   return db;
 }
 
@@ -367,3 +380,27 @@ test("RED/GREEN GUARD: a RAW-datasource plans.status write (the instanceTracking
   assertEquals(b.ack_open, epicIsAcknowledgeable("abandoned", b.delivery) ? 1 : 0);
   assertEquals(b.ack_open, 0, "no phantom Dismiss on a reconciler-cancelled epic");
 });
+
+test("RED/GREEN #503: a DERIVE-ONLY terminated epic (base status frozen, derived_status='abandoned') drops out of Active", () => {
+  // ADR-0065 (urban 0.81.0): cancel/terminate is DERIVE-ONLY — the reconciler feeds urban's projection
+  // and `plans__tracking.derived_status` recomputes `abandoned` on READ; it does NOT write the terminal
+  // onto the base `plans.status` column. So the base row stays frozen at its last transient
+  // (`dispatched`) while the epic is really terminated. Before 079 `plan_read_model` bucketed off the
+  // frozen base column and rendered the dead epic ACTIVE on the epic index/detail forever (the #503 /
+  // #497 phantom). 079 reads the effective status off `plans__tracking`, so it drops to History.
+  const db = viewDb();
+  // Seed a plan whose engine instance was terminated out-of-band: base status still `dispatched`, but
+  // the derive edge reports `abandoned` (modelled via the plans__tracking stand-in's override column).
+  db.prepare(
+    "INSERT INTO plans (plan_key, repo, issue_number, issue_url, status, task_count, updated_at, acknowledged_at, list_bucket, derived_status_override) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+  ).run("o/r#term", "o/r", 7, "https://gh/o/r#term", "dispatched", 0, "2026-01-01T00:00:00Z", null, "active", "abandoned");
+
+  const r = db
+    .prepare("SELECT status, list_bucket, ack_open FROM plan_read_model WHERE plan_key = ?")
+    .get("o/r#term") as { status: string; list_bucket: string; ack_open: number };
+
+  assertEquals(r.status, "abandoned", "plan_read_model surfaces the DERIVED terminal, not the frozen base transient");
+  assertEquals(r.list_bucket, "history", "a derive-only terminated epic is filed under History, not wedged Active");
+  assertEquals(r.list_bucket, deriveEpicBucket("abandoned", null, null));
+  assertEquals(r.ack_open, 0, "no phantom Dismiss on a derive-only terminated epic");
+});

package/app/service.ts

@@ -511,7 +511,14 @@ export async function submitPr(
 ) {
   const table = prs(data);
   const existing = await table.get(parsed.prKey);
-  if (existing && !TERMINAL_STATUSES.includes(existing.status)) {
+  // ADR-0065: classify "already running" on the DERIVED terminal edge, not the base transient. A
+  // PR whose engine instance was terminated out-of-band (or by an ordinary in-app cancel — derive-only
+  // under urban 0.81.0) has a base row frozen at its last worker transient (e.g. `converging`) but a
+  // `pull_requests__tracking.derived_status` of `abandoned`; reading the base `status` here would wedge
+  // it `alreadyRunning` forever (the #497 phantom). Route the idempotency gate through the derived view
+  // so a cancelled PR is correctly seen terminal and RESUBMITTABLE.
+  const trackedExisting = existing ? await prsTracking(data).get(parsed.prKey) : undefined;
+  if (trackedExisting && !TERMINAL_STATUSES.includes(trackedExisting.derived_status)) {
     return { prKey: parsed.prKey, alreadyRunning: true };
   }
 
@@ -747,9 +754,17 @@ export interface ActivePr {
  * BOTH loops' escalations uniformly. Once answered the row leaves `open`, so `openEscalation`
  * derives back to null. */
 export async function activePrs(data: DataLayer): Promise<ActivePr[]> {
-  const all = await prs(data).all();
+  const all = await prsTracking(data).all();
   const active = all
-    .filter((p) => !TERMINAL_STATUSES.includes(p.status))
+    // ADR-0065: classify "in flight" on the DERIVED terminal edge, not the base transient. A PR whose
+    // engine instance was terminated out-of-band (or by an ordinary in-app cancel — derive-only under
+    // urban 0.81.0) keeps its base `status` frozen at the last worker transient but reads `abandoned`
+    // on `pull_requests__tracking.derived_status`; filtering on the base `status` here left the
+    // Convergence tab showing a cancelled PR active indefinitely (the #497 phantom). The base
+    // `status`/worker-owned transient columns are still surfaced on each row below (the view re-exports
+    // `base.*`), and `pull_requests` has no `onWaitingHuman` edge, so for a still-active PR
+    // `derived_status === status`.
+    .filter((p) => !TERMINAL_STATUSES.includes(p.derived_status))
     .sort((a, b) => (a.updated_at < b.updated_at ? 1 : a.updated_at > b.updated_at ? -1 : 0));
   // Only an `escalated` PR is parked awaiting a human answer (either loop). Surface the question
   // from its latest still-open `escalations` row; a resubmit retires stale rows and finalize/merge
@@ -972,9 +987,9 @@ async function classifyWaveTarget(
   prKey: string,
   token: string,
 ): Promise<"cleared" | "closed" | "pending"> {
-  const tracked = await prs(data).get(prKey);
-  if (tracked && tracked.status === "merged") return "cleared";
-  if (tracked && tracked.status === ABANDONED_STATUS) return "cleared"; // already reconciled terminal → non-blocking, no re-reconcile needed
+  const tracked = await prsTracking(data).get(prKey);
+  if (tracked && tracked.status === "merged") return "cleared"; // worker-owned terminal, passes through the derive edge unchanged
+  if (tracked && tracked.derived_status === ABANDONED_STATUS) return "cleared"; // ADR-0065 derive-only terminal → non-blocking, no re-reconcile needed
   const parsed = parsePr(prKey);
   if (!parsed) return "cleared"; // unparseable ref can't be checked → never wedge the barrier
   let st: Awaited<ReturnType<typeof fetchPrState>>;
@@ -1016,7 +1031,7 @@ async function flipToMergingThenPublish(
   }
 }
 
-async function mergeLaneDecisionForPr(data: DataLayer, prKey: string): Promise<PrLaneDecision | null> {
+export async function mergeLaneDecisionForPr(data: DataLayer, prKey: string): Promise<PrLaneDecision | null> {
   const taskRows = await planTasks(data).find({ pr_key: prKey });
   const task = taskRows[0];
   if (!task) return null;
@@ -1034,8 +1049,12 @@ async function mergeLaneDecisionForPr(data: DataLayer, prKey: string): Promise<P
   const lanePrKeys = new Set([...taskToPr.values()]);
   const completedPrKeys = new Set<string>();
   for (const lanePrKey of lanePrKeys) {
-    const lanePr = await prs(data).get(lanePrKey);
-    if (lanePr && (lanePr.status === "merged" || lanePr.status === "abandoned")) {
+    const lanePr = await prsTracking(data).get(lanePrKey);
+    // ADR-0065: a lane member is complete when it MERGED (worker-owned terminal, base `status`) OR was
+    // cancelled/terminated (derive-only terminal → `derived_status === "abandoned"`; the base row is
+    // still frozen at its transient). Reading only base `status` here missed a cancelled member and
+    // stalled/misrouted the lane.
+    if (lanePr && (lanePr.status === "merged" || lanePr.derived_status === "abandoned")) {
       completedPrKeys.add(lanePr.pr_key);
     }
   }
@@ -1400,12 +1419,15 @@ async function pollJobActivation(
   const headers: Record<string, string> = { "content-type": "application/json" };
   if (engineToken) headers.authorization = `Bearer ${engineToken}`;
 
-  const all = await prs(data).all();
+  const all = await prsTracking(data).all();
   for (const pr of all) {
     // Only a `converging` PR has a live review-round job. Any other status with a stale worker
     // set (e.g. it just moved to `waiting_review`) gets cleared so the grid can't show a
-    // phantom "agent working".
-    if (pr.status !== "converging") {
+    // phantom "agent working". ADR-0065: classify on the DERIVED status, not the base transient —
+    // a PR whose instance was terminated out-of-band keeps its base `status` frozen at `converging`
+    // but reads `abandoned` on `derived_status`, so a base read would leave `active_worker`/
+    // `lease_until` set on a dead run (a phantom "agent working"). Writes stay on the base `prs`.
+    if (pr.derived_status !== "converging") {
       if (pr.active_worker || pr.lease_until) {
         await prs(data).update(pr.pr_key, {
           active_worker: null,
@@ -1512,13 +1534,16 @@ export async function pollIncidentsImpl(
   base: string,
   headers: Record<string, string>,
 ) {
-  const all = await prs(data).all();
+  const all = await prsTracking(data).all();
   for (const pr of all) {
     // No live instance to inspect (never created, mid-transition, or terminal — the run has
     // finished or was given up, so its instance is gone) → make sure no stale incident lingers on
-    // the row, then move on. Reuses the canonical `TERMINAL_STATUSES` so incident logic can't drift
-    // from the rest of the status machine.
-    if (!pr.process_key || TERMINAL_STATUSES.includes(pr.status)) {
+    // the row, then move on. ADR-0065: classify on the DERIVED terminal edge, not the base transient
+    // — a PR terminated out-of-band keeps its base `status` frozen at `converging` but reads
+    // `abandoned` on `derived_status`, so a base read would keep reconciling incidents against a dead
+    // instance. Reuses the canonical `TERMINAL_STATUSES` so incident logic can't drift from the rest
+    // of the status machine. Writes stay on the base `prs`.
+    if (!pr.process_key || TERMINAL_STATUSES.includes(pr.derived_status)) {
       if (pr.incident_key || pr.incident_message) {
         await prs(data).update(pr.pr_key, {
           incident_key: null,

package/app/stage.ts

@@ -14,7 +14,7 @@
 // anywhere (not in SQL, not in the page, not in each poller/worker): every reader flows through the
 // VIEW or these adapters, both sourced from the one declaration.
 
-import { type FeatureReadModelDerivedColumn, featureReadModel, STAGE_DONE_STATUSES, USER_TASKS_PROJECTION } from "./featureReadModel.ts";
+import { EFFECTIVE_STATUS_COLUMN, type FeatureReadModelDerivedColumn, featureReadModel, STAGE_DONE_STATUSES, USER_TASKS_PROJECTION } from "./featureReadModel.ts";
 
 // Re-exported for back-compat with existing importers (operations/acknowledgeDone.ts). Its canonical
 // home is now app/featureReadModel.ts, where it feeds the terminal tier of the derived columns.
@@ -90,7 +90,12 @@ function evalDerived<T>(column: FeatureReadModelDerivedColumn, baseRow: Record<s
 export function deriveStage(run: StageInput): DerivedStage {
   const baseRow = {
     feature_key: SELF_KEY,
-    status: run.status,
+    // The status-classifying derivations read the tracking VIEW's terminal-folded `derived_status`
+    // (ADR-0065), so this façade feeds the caller's effective `status` under that column name — the SQL
+    // VIEW reads `fr."derived_status"` off `feature_runs__tracking`, and both lowerings agree by
+    // construction (`assertReadModelParity`). Callers off the write path pass the run's effective
+    // status (which equals the base transient for any non-terminated run).
+    [EFFECTIVE_STATUS_COLUMN]: run.status,
     pr_key: run.pr_key ?? null,
     converge: run.converge ?? null,
     auto_merge: run.auto_merge ?? null,
@@ -111,5 +116,5 @@ export function deriveStage(run: StageInput): DerivedStage {
  * `feature_runs.list_bucket` base column is vestigial (retired as a write projection, issue #439). This
  * adapter is the TS lowering of that derivation, used off the write path (redispatch gating, tests). */
 export function deriveListBucket(status: string, acknowledgedAt: string | null | undefined): "active" | "history" {
-  return evalDerived<"active" | "history">("list_bucket", { status, acknowledged_at: acknowledgedAt ?? null });
+  return evalDerived<"active" | "history">("list_bucket", { [EFFECTIVE_STATUS_COLUMN]: status, acknowledged_at: acknowledgedAt ?? null });
 }

package/app/terminalReaderBehaviour.test.ts

@@ -0,0 +1,289 @@
+// Behaviour coverage for issue #503 — the ADR-0065 derive-only-terminal divergence at the terminal
+// EDGE readers. Under `@nanobpm/urban@0.81.0` the `instanceTracking` reconciler no longer WRITES the
+// terminal `abandoned`/`failed`/`reviewed` onto the base `status`; it re-derives it on read via the
+// `<table>__tracking.derived_status` VIEW. A PR/plan whose engine instance was terminated out-of-band
+// (or by an ordinary in-app cancel) therefore keeps its base `status` frozen at its last worker
+// transient (e.g. `converging`/`dispatched`) while `derived_status` reads `abandoned`.
+//
+// Each test seeds that EXACT divergence (base row `status: "converging"`, `derived_status: "abandoned"`)
+// via the `withTrackingViews` seam, and asserts the reader classifies on the derived edge:
+//   - a terminated PR is RESUBMITTABLE (not wedged `alreadyRunning`) and absent from `activePrs`,
+//   - a terminated instance sheds its stale incident,
+//   - a terminated lane member counts as COMPLETE (does not stall the merge lane),
+//   - a terminated epic is not counted active (no false same-base conflict) and is RE-ADMITTABLE.
+// Reading only the base `status` (the pre-#503 behaviour) fails every one of these — the RED.
+
+import { test } from "node:test";
+import { assertEquals } from "#test-assert";
+import { withTrackingViews } from "../test/trackingViews.ts";
+import { findActivePlansByBase, startPlan } from "./plan.ts";
+import { activePrs, mergeLaneDecisionForPr, pollIncidentsImpl, pollWaveGatesImpl, submitPr } from "./service.ts";
+
+function memTable(rows: any[], key: string) {
+  return {
+    get: (k: any) => Promise.resolve(rows.find((r) => r[key] === k) ?? null),
+    all: () => Promise.resolve([...rows]),
+    find: (q: any) =>
+      Promise.resolve(rows.filter((r) => Object.entries(q).every(([f, v]) => r[f] === v))),
+    findOne: (q: any) =>
+      Promise.resolve(rows.find((r) => Object.entries(q).every(([f, v]) => r[f] === v)) ?? null),
+    count: (q: any) =>
+      Promise.resolve(rows.filter((r) => Object.entries(q).every(([f, v]) => r[f] === v)).length),
+    insert: (r: any) => {
+      rows.push(r);
+      return Promise.resolve(r);
+    },
+    update: (k: any, patch: any) => {
+      const r = rows.find((x) => x[key] === k);
+      if (r) Object.assign(r, patch);
+      return Promise.resolve(r);
+    },
+    delete: (k: any) => {
+      for (let i = rows.length - 1; i >= 0; i--) if (rows[i][key] === k) rows.splice(i, 1);
+      return Promise.resolve();
+    },
+  };
+}
+
+type Stores = Record<string, { rows: any[]; key: string }>;
+
+function memData(stores: Stores) {
+  return {
+    table: withTrackingViews((name: string, key: string) =>
+      memTable(stores[name]?.rows ?? [], stores[name]?.key ?? key)),
+  } as any;
+}
+
+function withGithubOff(run: () => Promise<void>): Promise<void> {
+  const prevMode = process.env["NANO_PR_GITHUB_TRANSPORT"];
+  const prevTok = process.env["GITHUB_TOKEN"];
+  process.env["NANO_PR_GITHUB_TRANSPORT"] = "token"; // no token below -> fetchPrMeta returns null
+  delete process.env["GITHUB_TOKEN"];
+  return run().finally(() => {
+    if (prevMode !== undefined) process.env["NANO_PR_GITHUB_TRANSPORT"] = prevMode;
+    else delete process.env["NANO_PR_GITHUB_TRANSPORT"];
+    if (prevTok !== undefined) process.env["GITHUB_TOKEN"] = prevTok;
+  });
+}
+
+// #503 / #497: `submitPr`'s idempotency gate reads `derived_status`, so a derive-only-terminated PR
+// (base frozen at `converging`, `derived_status = abandoned`) is seen terminal and RESUBMITTABLE —
+// it re-opens for a fresh convergence run instead of wedging `alreadyRunning`.
+test("submitPr re-opens a derive-only-terminated PR (base 'converging', derived 'abandoned') — not alreadyRunning", async () => {
+  await withGithubOff(async () => {
+    const PR_KEY = "owner/repo#42";
+    const stores: Stores = {
+      pull_requests: {
+        rows: [{
+          pr_key: PR_KEY,
+          repo: "owner/repo",
+          number: 42,
+          url: "https://github.com/owner/repo/pull/42",
+          title: "t",
+          status: "converging", // base transient FROZEN — reconciler no longer writes the terminal
+          derived_status: "abandoned", // ADR-0065 derive-only terminal
+          current_round: 3,
+        }],
+        key: "pr_key",
+      },
+      escalations: { rows: [], key: "id" },
+      pr_dependencies: { rows: [], key: "pr_key" },
+    };
+    const data = memData(stores);
+    const engine = { createInstance: () => Promise.resolve({ processInstanceKey: "PI-9" }) } as any;
+
+    const res = await submitPr(data, engine, {
+      repo: "owner/repo",
+      number: 42,
+      url: "https://github.com/owner/repo/pull/42",
+      prKey: PR_KEY,
+    });
+
+    assertEquals((res as any).alreadyRunning, undefined); // NOT wedged
+    assertEquals(res.processKey, "PI-9");
+    const pr = stores.pull_requests.rows[0];
+    assertEquals(pr.status, "converging");
+    assertEquals(pr.current_round, 1); // re-opened for a fresh run
+    assertEquals(pr.process_key, "PI-9");
+  });
+});
+
+// #503 / #497 phantom: `activePrs` filters on `derived_status`, so a derive-only-terminated PR drops
+// off the Convergence tab instead of showing "active" indefinitely.
+test("activePrs excludes a derive-only-terminated PR and keeps a genuinely active one", async () => {
+  const stores: Stores = {
+    pull_requests: {
+      rows: [
+        { pr_key: "o/r#1", repo: "o/r", number: 1, url: "u1", status: "converging", derived_status: "abandoned", current_round: 2, updated_at: "2024-01-02" },
+        { pr_key: "o/r#2", repo: "o/r", number: 2, url: "u2", status: "converging", derived_status: "converging", current_round: 1, updated_at: "2024-01-01" },
+      ],
+      key: "pr_key",
+    },
+    escalations: { rows: [], key: "id" },
+  };
+  const active = await activePrs(memData(stores));
+  assertEquals(active.map((p) => p.prKey), ["o/r#2"]);
+});
+
+// #503: `pollIncidentsImpl` classifies a dead instance on `derived_status`, so a derive-only-terminated
+// PR sheds its stale incident (rather than re-reconciling against a gone instance), and NEVER queries
+// the engine for it. A live PR still gets queried.
+test("pollIncidentsImpl clears a stale incident off a derive-only-terminated PR without querying the engine", async () => {
+  const stores: Stores = {
+    pull_requests: {
+      rows: [{
+        pr_key: "o/r#7",
+        repo: "o/r",
+        number: 7,
+        url: "u",
+        status: "converging",
+        derived_status: "abandoned",
+        process_key: "PI-DEAD",
+        incident_key: "INC-1",
+        incident_message: "boom",
+      }],
+      key: "pr_key",
+    },
+  };
+  const prevFetch = globalThis.fetch;
+  let queried = false;
+  globalThis.fetch = (() => {
+    queried = true;
+    throw new Error("engine must not be queried for a derive-only-terminated PR");
+  }) as any;
+  try {
+    await pollIncidentsImpl(memData(stores), "http://engine", {});
+  } finally {
+    globalThis.fetch = prevFetch;
+  }
+  assertEquals(queried, false);
+  const pr = stores.pull_requests.rows[0];
+  assertEquals(pr.incident_key, null);
+  assertEquals(pr.incident_message, null);
+});
+
+// #503: the merge-lane decision counts a lane member COMPLETE on the derived terminal edge, so a
+// derive-only-abandoned member (base 'converging') no longer holds its lane-mate behind a dead PR.
+test("mergeLaneDecisionForPr treats a derive-only-abandoned lane member as complete (does not hold the lane)", async () => {
+  const PLAN_KEY = "o/r#100";
+  const stores: Stores = {
+    plan_tasks: {
+      rows: [
+        { id: 1, plan_key: PLAN_KEY, task_id: "a", pr_key: "o/r#1" },
+        { id: 2, plan_key: PLAN_KEY, task_id: "b", pr_key: "o/r#2" },
+      ],
+      key: "id",
+    },
+    plan_merge_exclusions: {
+      // a & b collide on a shared surface → one landing lane, land one-at-a-time
+      rows: [{ id: 1, plan_key: PLAN_KEY, task_a: "a", task_b: "b", files: JSON.stringify(["shared.ts"]), source: "file-overlap" }],
+      key: "id",
+    },
+    plan_task_deps: { rows: [], key: "plan_key" },
+    pull_requests: {
+      rows: [
+        // lane head candidate `a`: derive-only-terminated (base frozen, derived abandoned)
+        { pr_key: "o/r#1", repo: "o/r", number: 1, status: "converging", derived_status: "abandoned" },
+        // `b`: the PR we ask about — still converging
+        { pr_key: "o/r#2", repo: "o/r", number: 2, status: "converging", derived_status: "converging" },
+      ],
+      key: "pr_key",
+    },
+  };
+  const decision = await mergeLaneDecisionForPr(memData(stores), "o/r#2");
+  // With `a` counted complete, `b` is free to land — NOT held behind the dead member.
+  assertEquals(decision?.isHeld, false);
+});
+
+// #503: `classifyWaveTarget` classifies a wave member on the derived terminal edge, so a
+// derive-only-abandoned member (base frozen at `converging`, still notionally open) is treated
+// NON-BLOCKING (`cleared`) WITHOUT a GitHub round-trip — the wave gate advances instead of wedging on
+// a dead member. Driven through `pollWaveGatesImpl`: with the sole gate member cleared and the token
+// parked at `wait-wave-merged`, the barrier is released (`wave-merged` published). Reading the base
+// `status` (the RED) would fall through to a GitHub liveness read (which, with no live "merged"
+// signal, returns `pending`) and never publish.
+test("classifyWaveTarget treats a derive-only-abandoned wave member as cleared and releases the gate (no GitHub read)", async () => {
+  await withGithubOff(async () => {
+    const PLAN_KEY = "o/r#200";
+    const stores: Stores = {
+      plans: { rows: [{ plan_key: PLAN_KEY, gate_wave: 0, process_key: "PI-1" }], key: "plan_key" },
+      plan_tasks: {
+        rows: [{ id: 1, plan_key: PLAN_KEY, task_id: "a", wave: 0, status: "opened", pr_key: "o/r#1" }],
+        key: "id",
+      },
+      pull_requests: {
+        rows: [{ pr_key: "o/r#1", repo: "o/r", number: 1, status: "converging", derived_status: "abandoned" }],
+        key: "pr_key",
+      },
+    };
+    const published: unknown[] = [];
+    const engine = { publishMessage: (m: unknown) => (published.push(m), Promise.resolve()) } as any;
+    const prevFetch = globalThis.fetch;
+    // Confirm the token is parked at the `wave-merged` wait so the barrier is releasable; a GitHub
+    // liveness read for the abandoned member would be a bug (it's classified `cleared` off the view).
+    globalThis.fetch = ((url: string) => {
+      if (String(url).endsWith("/message-subscriptions/search")) {
+        return Promise.resolve(
+          new Response(
+            JSON.stringify({ items: [{ messageName: "wave-merged", correlationKey: PLAN_KEY, messageSubscriptionState: "CREATED" }] }),
+            { status: 200, headers: { "content-type": "application/json" } },
+          ),
+        );
+      }
+      throw new Error(`no GitHub read expected for a derive-only-abandoned wave member: ${url}`);
+    }) as any;
+    try {
+      await pollWaveGatesImpl(memData(stores), engine, "", "http://engine", {});
+    } finally {
+      globalThis.fetch = prevFetch;
+    }
+    assertEquals(published.length, 1); // wave released — the abandoned member did not block it
+  });
+});
+
+
+// derive-only-abandoned epic (base frozen at `dispatched`) is NOT counted active and raises no false
+// same-base conflict.
+test("findActivePlansByBase excludes a derive-only-abandoned epic", async () => {
+  const stores: Stores = {
+    plans: {
+      rows: [
+        { plan_key: "o/r#10", repo: "o/r", base_branch: "epic/x", status: "dispatched", derived_status: "abandoned" },
+        { plan_key: "o/r#11", repo: "o/r", base_branch: "epic/x", status: "dispatched", derived_status: "dispatched" },
+      ],
+      key: "plan_key",
+    },
+  };
+  const active = await findActivePlansByBase(memData(stores), "o/r", "epic/x");
+  assertEquals(active.map((p) => p.plan_key), ["o/r#11"]);
+});
+
+// #503: `startPlan`'s idempotency gate reads `derived_status`, so a derive-only-abandoned epic (base
+// frozen at `dispatched`) is seen terminal and RE-ADMITTABLE — it re-plans instead of wedging
+// `alreadyRunning`.
+test("startPlan re-admits a derive-only-abandoned epic (base 'dispatched', derived 'abandoned') — not alreadyRunning", async () => {
+  await withGithubOff(async () => {
+    const PLAN_KEY = "owner/repo#7";
+    const stores: Stores = {
+      plans: {
+        rows: [{ plan_key: PLAN_KEY, repo: "owner/repo", base_branch: "epic/x", status: "dispatched", derived_status: "abandoned", task_count: 1 }],
+        key: "plan_key",
+      },
+      plan_tasks: { rows: [{ id: 1, plan_key: PLAN_KEY }], key: "id" },
+      plan_reviews: { rows: [], key: "plan_key" },
+      plan_task_deps: { rows: [], key: "plan_key" },
+    };
+    const engine = { createInstance: () => Promise.resolve({ processInstanceKey: "PI-1" }) } as any;
+
+    const res = await startPlan(memData(stores), engine, {
+      repo: "owner/repo",
+      number: 7,
+      url: "https://github.com/owner/repo/issues/7",
+      planKey: PLAN_KEY,
+    }, "epic/x");
+
+    assertEquals((res as any).alreadyRunning, undefined); // NOT wedged — re-planned
+    // The prior epic's tasks were cleared on the re-plan path (proves it did NOT short-circuit).
+    assertEquals(stores.plan_tasks.rows.length, 0);
+  });
+});

package/app/terminalReaderGuard.test.ts

@@ -0,0 +1,106 @@
+// Class guard for the ADR-0065 terminal-edge reader migration (issue #503).
+//
+// Since ADR-0065 (`@nanobpm/urban@0.81.0`) the `instanceTracking` reconciler is a SOURCE, not a
+// writer: on cancel/terminate it feeds urban's instance projection and the terminal edge
+// (`onTerminated`) is RECOMPUTED ON READ as `<table>__tracking.derived_status` — it NO LONGER writes
+// the terminal (`abandoned`/`failed`/`reviewed`) onto the base `status` column. A classifying reader
+// that inspects the BASE `status` column of a DERIVE-ONLY tracked table therefore sees a row frozen at
+// its last worker-owned transient after the instance ends → phantom-active / wedged-idempotency bugs
+// (the #497 / #503 class).
+//
+// This is a SOURCE-SCAN guard over the defect CLASS, not a single instance: it asserts that every
+// terminal/active classification (`TERMINAL_STATUSES.includes` / `=== ABANDONED_STATUS` /
+// `PLAN_TERMINAL_STATUSES` / the feature read model's status DSL) for the three derive-only tracked
+// tables (`pull_requests`, `plans`, `feature_runs`) reads the DERIVED effective status
+// (`.derived_status`), never the frozen base `.status`. A future reader that silently re-drifts onto
+// the base column fails here.
+//
+// Worker-owned terminals that PASS THROUGH the derive edge unchanged (`merged`) are exempt: a base
+// `=== "merged"` read is legitimate (see `isDepMerged` / `classifyWaveTarget` / `mergeLaneDecisionForPr`
+// in app/service.ts). Only the DERIVE-ONLY terminals (`abandoned`/`failed`/`reviewed`) must route
+// through the derived accessor. Writers (`data.table(<table>).update({ status: … })`) are unaffected —
+// they still write the base column.
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import { EFFECTIVE_STATUS_COLUMN } from "./featureReadModel.ts";
+
+const SRC = (name: string): string => readFileSync(fileURLToPath(new URL(`./${name}`, import.meta.url)), "utf8");
+
+/** Strip line (`//`) and block (`/* … *​/`) comments so the scan only inspects executable code — a
+ * doc comment may legitimately mention `.status` in prose without being a classification. The line
+ * stripper skips a `//` preceded by `:` so a URL scheme inside a string/template literal (e.g.
+ * `https://…` in app/service.ts) is not mistaken for a comment start and does not corrupt the scan. */
+function stripComments(src: string): string {
+  return src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1");
+}
+
+test("class guard: every TERMINAL_STATUSES classification in service.ts reads derived_status, not base status", () => {
+  const code = stripComments(SRC("service.ts"));
+  const calls = [...code.matchAll(/TERMINAL_STATUSES\.includes\(([^)]*)\)/g)];
+  assert(calls.length > 0, "expected TERMINAL_STATUSES.includes classifications in service.ts");
+  for (const m of calls) {
+    const arg = m[1];
+    assert(
+      /\.derived_status\b/.test(arg),
+      `TERMINAL_STATUSES.includes(${arg}) classifies on the BASE status of a derive-only tracked table — ` +
+        `route it through prsTracking and read \`.derived_status\` (ADR-0065, #503)`,
+    );
+    assert(
+      !/[A-Za-z0-9_)\]]\.status\b/.test(arg),
+      `TERMINAL_STATUSES.includes(${arg}) still reads a base \`.status\` — the terminal edge is derive-only (#503)`,
+    );
+  }
+});
+
+test("class guard: no base `.status === ABANDONED_STATUS` / `.status === \"abandoned\"` read classification in service.ts", () => {
+  const code = stripComments(SRC("service.ts"));
+  // A READ classification against the derive-only `abandoned` terminal must use `.derived_status`. A
+  // base `.status === ABANDONED_STATUS`/`"abandoned"` would miss a derive-only-terminated PR. (Writers
+  // use the object-literal form `{ status: ABANDONED_STATUS }`, which this pattern never matches.)
+  const bad = [
+    ...code.matchAll(/[A-Za-z0-9_)\]]\.status\s*===\s*ABANDONED_STATUS/g),
+    ...code.matchAll(/[A-Za-z0-9_)\]]\.status\s*===\s*["']abandoned["']/g),
+  ];
+  assertEquals(
+    bad.length,
+    0,
+    `a base \`.status\` is compared to the derive-only \`abandoned\` terminal — read \`.derived_status\` off ` +
+      `prsTracking instead (ADR-0065, #503): ${bad.map((m) => m[0]).join(", ")}`,
+  );
+});
+
+test("class guard: every PLAN_TERMINAL_STATUSES classification in plan.ts reads derived_status, not base status", () => {
+  const code = stripComments(SRC("plan.ts"));
+  // Match the `.some((s) => s === <ref>)` classification form used at both admission sites.
+  const calls = [...code.matchAll(/PLAN_TERMINAL_STATUSES\.some\(\([^)]*\)\s*=>\s*[^)]*===\s*([A-Za-z0-9_.]+)\)/g)];
+  assert(calls.length > 0, "expected PLAN_TERMINAL_STATUSES classifications in plan.ts");
+  for (const m of calls) {
+    const ref = m[1];
+    assert(
+      /\.derived_status$/.test(ref),
+      `PLAN_TERMINAL_STATUSES classification reads \`${ref}\` — route it through plansTracking and read ` +
+        `\`.derived_status\` so a derive-only-terminated epic is seen terminal (ADR-0065, #503)`,
+    );
+  }
+});
+
+test("class guard: the feature read model classifies on derived_status, never the base status column", () => {
+  // The feature history read model (app/featureReadModel.ts) buckets a run's pipeline `stage`/
+  // `list_bucket` off its status. Under ADR-0065 that must be the terminal-folded `derived_status`
+  // (off `feature_runs__tracking`), or a terminated run renders "Implementing" forever. Assert the DSL
+  // never references the base `col("status")` for classification and that the effective-status column
+  // is the derived one.
+  assertEquals(EFFECTIVE_STATUS_COLUMN, "derived_status", "the feature read model's effective status must be the derived column");
+  const code = stripComments(SRC("featureReadModel.ts"));
+  assert(
+    !/col\(\s*["']status["']\s*\)/.test(code),
+    'app/featureReadModel.ts still references col("status") — the status-classifying derivations must ' +
+      'read col("derived_status") off feature_runs__tracking (ADR-0065, #503)',
+  );
+  assert(
+    /baseTable:\s*FEATURE_READ_MODEL_BASE_TABLE/.test(code) || /feature_runs__tracking/.test(code),
+    "the feature read model must be based on the feature_runs__tracking derived VIEW (ADR-0065, #503)",
+  );
+});

package/db/migrations/080_plan_read_model_derive_terminal.sql

@@ -0,0 +1,75 @@
+-- Fold the ADR-0065 DERIVED terminal edge into the epic read model (issue #503 — the plans row of the
+-- "migrate remaining terminal-edge readers to derived_status" class).
+--
+-- Since ADR-0065 (`@nanobpm/urban@0.81.0`) the `instanceTracking` reconciler is a SOURCE, not a writer:
+-- on cancel/terminate it feeds urban's instance projection and the terminal edge (`onTerminated →
+-- abandoned`) is RECOMPUTED ON READ as `plans__tracking.derived_status` — it NO LONGER writes
+-- `abandoned` onto the base `plans.status` column. `plans` had NO derived reader, so a terminated epic's
+-- base row stayed frozen at `planning`/`dispatched` and 074's `plan_read_model` bucketed it ACTIVE
+-- forever (a terminated epic rendered active on the epic index/detail).
+--
+-- 074_plan_read_model_derive_bucket.sql made `plan_read_model` the composite VIEW the epic pages bind
+-- and DERIVED `list_bucket`/`ack_open` from the base `plans.status` (+ `acknowledged_at` + the derived
+-- `plan_delivery.delivery` signal). This migration redefines `plan_read_model` (same name, so no page
+-- repoint is needed) to read the EFFECTIVE status off the auto-provisioned `plans__tracking` derived
+-- VIEW instead of the frozen base column: the projected `status` and the bucket/ack derivations now
+-- fold in the reconciler's terminal edge, so a cancelled/terminated epic drops out of Active with no
+-- worker write and no poller pass.
+--
+-- `plans__tracking` is the managed VIEW urban provisions at mount (`<table>__tracking`, ADR-0065),
+-- re-exporting `plans.*` plus a `derived_status` column that is `abandoned` on a terminated instance and
+-- the base `plans.status` otherwise. SQLite does not validate a view body at CREATE time, so this
+-- migration (which runs before the runtime mount that provisions `plans__tracking`) is created fine and
+-- resolves once the managed VIEW exists. The `COALESCE(t.derived_status, pl.status)` fallback degrades to
+-- the previous base-column behaviour only for an unexpected NULL `derived_status` or a missing joined row
+-- (the LEFT JOIN yielding no `t` row) — it does NOT protect against the `plans__tracking` VIEW being
+-- absent, which would fail this VIEW's query at read time.
+--
+-- A merged view is not editable in place (that would edit a shipped migration), so this DROPs and
+-- re-CREATEs it. `plan_read_model` is a leaf — no other view builds on it — so the DROP is safe. Its
+-- output column set is UNCHANGED (only the SOURCE of `status`/`list_bucket`/`ack_open` moved from the
+-- base column to the derived VIEW), so the pages↔schema contract guard and every page binding stay
+-- valid.
+--
+-- Forward-only. NO BEGIN/COMMIT — the runner wraps each file in its own transaction. Numbered after 078.
+
+DROP VIEW plan_read_model;
+
+CREATE VIEW plan_read_model AS
+SELECT
+  pl.plan_key AS plan_key,
+  pl.repo AS repo,
+  pl.issue_number AS issue_number,
+  pl.issue_url AS issue_url,
+  pl.title AS title,
+  COALESCE(t.derived_status, pl.status) AS status,
+  pl.task_count AS task_count,
+  pl.process_key AS process_key,
+  pl.outcome AS outcome,
+  pl.updated_at AS updated_at,
+  pl.epic_phase AS epic_phase,
+  pl.base_branch AS base_branch,
+  pl.wait_gate_label AS wait_gate_label,
+  pl.bound_artifacts AS bound_artifacts,
+  pl.promotion_pr AS promotion_pr,
+  pl.promotion_state AS promotion_state,
+  (CASE
+    WHEN COALESCE(t.derived_status, pl.status) IN ('planning', 'dispatched') THEN 'active'
+    WHEN COALESCE(t.derived_status, pl.status) = 'done' AND d.delivery = 'converging' THEN 'active'
+    WHEN COALESCE(t.derived_status, pl.status) = 'done' AND pl.acknowledged_at IS NULL THEN 'active'
+    WHEN COALESCE(t.derived_status, pl.status) = 'done' THEN 'history'
+    ELSE 'history'
+  END) AS list_bucket,
+  (CASE
+    WHEN COALESCE(t.derived_status, pl.status) = 'done' AND d.delivery IS NOT 'converging' AND pl.acknowledged_at IS NULL THEN 1
+    ELSE 0
+  END) AS ack_open,
+  wl.wave_count AS wave_count,
+  wl.current_wave AS current_wave,
+  wl.wave_label AS wave_label,
+  d.delivery AS delivery,
+  d.delivery_label AS delivery_label
+FROM plans pl
+LEFT JOIN plans__tracking t ON t.plan_key = pl.plan_key
+LEFT JOIN plan_wave_label wl ON wl.plan_key = pl.plan_key
+LEFT JOIN plan_delivery d ON d.plan_key = pl.plan_key;

package/db/migrations/081_feature_read_model_derive_terminal.sql

@@ -0,0 +1,65 @@
+-- Feature-run read model: fold the ADR-0065 DERIVED terminal edge into the projection (issue #503 —
+-- the feature_runs row of the "migrate remaining terminal-edge readers to derived_status" class).
+--
+-- Since ADR-0065 (`@nanobpm/urban@0.81.0`) the `instanceTracking` reconciler is a SOURCE, not a writer:
+-- on cancel/terminate it feeds urban's instance projection and the terminal edge (`onTerminated →
+-- abandoned`) is RECOMPUTED ON READ as `feature_runs__tracking.derived_status` — it NO LONGER writes
+-- `abandoned` onto the base `feature_runs.status` column. `feature_runs` had NO derived reader, so a
+-- terminated feature run's base row stayed frozen at `running`/`escalated`/`awaiting_operator` and
+-- 076's `feature_read_model` rendered it "Implementing" (never "failed") on the Feature history grid
+-- forever.
+--
+-- 076_feature_read_model_declare_once.sql authored the projection ONCE (`defineReadModel`,
+-- app/featureReadModel.ts) and emitted each derived column VERBATIM from that declaration; it read the
+-- base `feature_runs.status`. This migration SUPERSEDES 076's VIEW body: the declaration's `baseTable`
+-- is now the auto-provisioned `feature_runs__tracking` derived VIEW (which re-exports `feature_runs.*`
+-- plus a terminal-folded `derived_status`), and every status-classifying derived column below reads
+-- `fr."derived_status"` instead of `fr."status"`. So a cancelled/terminated run renders `Done`/`failed`
+-- with no worker write. 076 is a MERGED, IMMUTABLE migration — never edited; this is a NEW migration
+-- superseding its VIEW body (the same pattern by which 076 superseded 073/075).
+--
+-- Every DERIVED column body is emitted VERBATIM from the ONE declaration
+-- (`featureReadModel.sqlSelectFor(col, { baseAlias: "fr" })`), which ALSO drives the runtime TS via
+-- `fnFor` — the two lowerings fall out of the same closed-DSL AST and cannot diverge. The drift guard
+-- (app/featureReadModel.test.ts) fails if this file stops matching the declaration, and
+-- `assertReadModelParity` proves the SQL and TS lowerings agree. SEMANTICS are unchanged from 076 EXCEPT
+-- the status source (base transient → terminal-folded `derived_status`): `attention` still derives from
+-- ENGINE TRUTH (an OPEN `user_tasks` row, issue #422); `stage_skipped` is still a pure function of
+-- `converge`/`auto_merge`.
+--
+-- `feature_runs__tracking` is the managed VIEW urban provisions at mount (`<table>__tracking`); SQLite
+-- does not validate a view body at CREATE time, so this migration (which runs before the runtime mount
+-- that provisions the managed VIEW) is created fine and resolves once the managed VIEW exists. Base
+-- columns stay aliased pass-throughs (so the static pages↔schema contract guard still sees the VIEW
+-- columns), now sourced off `feature_runs__tracking`'s re-export of `base.*`; `feature_runs__tracking fr`
+-- is the sole top-level FROM (the user_tasks lookups are nested EXISTS subqueries at paren depth >= 1).
+--
+-- Forward-only VIEW redefinition (DROP then CREATE). The runner wraps each file in its own transaction,
+-- so this file must NOT contain BEGIN/COMMIT. Numbered after 079.
+
+DROP VIEW IF EXISTS feature_read_model;
+
+CREATE VIEW feature_read_model AS
+SELECT
+  fr.feature_key AS feature_key,
+  fr.repo AS repo,
+  fr.issue_number AS issue_number,
+  fr.issue_url AS issue_url,
+  fr.title AS title,
+  fr.base_branch AS base_branch,
+  fr.status AS status,
+  fr.process_key AS process_key,
+  fr.pr_key AS pr_key,
+  fr.converge AS converge,
+  fr.auto_merge AS auto_merge,
+  fr.outcome AS outcome,
+  fr.delivery_label AS delivery_label,
+  fr.acknowledged_at AS acknowledged_at,
+  fr.created_at AS created_at,
+  fr.updated_at AS updated_at,
+  CASE WHEN COALESCE((COALESCE(("fr"."derived_status" = 'merged'), 0) OR COALESCE(("fr"."derived_status" = 'converged'), 0) OR COALESCE(("fr"."derived_status" = 'blocked'), 0) OR COALESCE(("fr"."derived_status" = 'failed'), 0) OR COALESCE(("fr"."derived_status" = 'skipped'), 0) OR COALESCE(("fr"."derived_status" = 'abandoned'), 0)), 0) THEN 'Done' WHEN COALESCE(("fr"."derived_status" = 'converging'), 0) THEN 'Converging' WHEN COALESCE((COALESCE(("fr"."pr_key" <> ''), 0) OR COALESCE(("fr"."derived_status" = 'opened'), 0)), 0) THEN 'PR open' WHEN COALESCE((COALESCE(("fr"."derived_status" = 'running'), 0) OR COALESCE(("fr"."derived_status" = 'escalated'), 0) OR COALESCE(("fr"."derived_status" = 'awaiting_operator'), 0)), 0) THEN 'Implementing' ELSE 'Requested' END AS stage,
+  CASE WHEN COALESCE((COALESCE(("fr"."derived_status" = 'merged'), 0) OR COALESCE(("fr"."derived_status" = 'converged'), 0)), 0) THEN 'ok' WHEN COALESCE(("fr"."derived_status" = 'blocked'), 0) THEN 'blocked' WHEN COALESCE((COALESCE(("fr"."derived_status" = 'failed'), 0) OR COALESCE(("fr"."derived_status" = 'skipped'), 0) OR COALESCE(("fr"."derived_status" = 'abandoned'), 0)), 0) THEN 'failed' ELSE NULL END AS stage_state,
+  CASE WHEN (NOT COALESCE("fr"."converge", 0)) THEN 'Converging Merging' WHEN (NOT COALESCE("fr"."auto_merge", 0)) THEN 'Merging' ELSE '' END AS stage_skipped,
+  CASE WHEN EXISTS (SELECT 1 FROM "user_tasks" AS "__urban_proj_0" WHERE COALESCE((COALESCE(("__urban_proj_0"."subject_type" = 'feature'), 0) AND COALESCE(("__urban_proj_0"."subject_key" = "fr"."feature_key"), 0) AND COALESCE(("__urban_proj_0"."element_id" = 'feature-blocked'), 0)), 0)) THEN 'blocked' WHEN EXISTS (SELECT 1 FROM "user_tasks" AS "__urban_proj_0" WHERE COALESCE((COALESCE(("__urban_proj_0"."subject_type" = 'feature'), 0) AND COALESCE(("__urban_proj_0"."subject_key" = "fr"."feature_key"), 0) AND COALESCE(("__urban_proj_0"."element_id" = 'feature-escalation'), 0)), 0)) THEN '⚠' ELSE NULL END AS attention,
+  CASE WHEN COALESCE((COALESCE((COALESCE(("fr"."derived_status" = 'merged'), 0) OR COALESCE(("fr"."derived_status" = 'converged'), 0) OR COALESCE(("fr"."derived_status" = 'blocked'), 0) OR COALESCE(("fr"."derived_status" = 'failed'), 0) OR COALESCE(("fr"."derived_status" = 'skipped'), 0) OR COALESCE(("fr"."derived_status" = 'abandoned'), 0)), 0) AND COALESCE(("fr"."acknowledged_at" = "fr"."acknowledged_at"), 0)), 0) THEN 'history' ELSE 'active' END AS list_bucket
+FROM feature_runs__tracking fr;

package/operations/listActivePrs.test.ts

@@ -5,6 +5,7 @@ import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { noopLog } from "../test/log.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import handler from "./listActivePrs.ts";
 
 function memApp(rows: any[], escalations: any[] = []): AppApi {
@@ -24,7 +25,7 @@ function memApp(rows: any[], escalations: any[] = []): AppApi {
       },
     };
   };
-  return { data: { table }, log: noopLog() } as any as AppApi;
+  return { data: { table: withTrackingViews(table) }, log: noopLog() } as any as AppApi;
 }
 
 function input(headers: Record<string, string> = {}) {

package/operations/startEpicSet.admission.integration.test.ts

@@ -18,6 +18,7 @@ import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { resetDefaultBranchCache } from "../app/github.ts";
 import { noopLog } from "../test/log.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import startEpicSet from "./startEpicSet.ts";
 
 // ── in-memory github model (mirrors startPlanFanout.admission.integration.test.ts) ───────────────
@@ -116,7 +117,7 @@ function makeApp(seedPlans: Record<string, unknown>[] = []) {
     };
   };
   const app = {
-    data: { table },
+    data: { table: withTrackingViews(table) },
     engine: {
       createInstance: (req: { processDefinitionId: string; variables?: Record<string, unknown> }) => {
         started.push(req);
@@ -526,7 +527,7 @@ function makeSqliteApp(
     delete: () => Promise.resolve(),
   });
   const app = {
-    data: { table },
+    data: { table: withTrackingViews(table) },
     engine: { createInstance: () => Promise.resolve({ processInstanceKey: "PI-1" }) },
     log: noopLog(),
   } as any as AppApi;

package/operations/startPlanFanout.admission.integration.test.ts

@@ -9,6 +9,7 @@ import { assertEquals } from "#test-assert";
 import type { AppApi } from "@nanobpm/urban";
 import { resetDefaultBranchCache } from "../app/github.ts";
 import { noopLog } from "../test/log.ts";
+import { withTrackingViews } from "../test/trackingViews.ts";
 import startPlanFanout from "./startPlanFanout.ts";
 
 // ── in-memory github model ───────────────────────────────────────────────────
@@ -112,7 +113,7 @@ function makeApp(seedPlans: Record<string, unknown>[] = []) {
     };
   };
   const app = {
-    data: { table },
+    data: { table: withTrackingViews(table) },
     engine: {
       createInstance: (req: { processDefinitionId: string; variables?: Record<string, unknown> }) => {
         started.push(req);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.133.0",
+  "version": "0.133.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/test/trackingViews.ts

@@ -30,7 +30,17 @@ export function withTrackingViews<F extends TableFn>(base: F): F {
     const statusField = baseStatusFieldFor(baseName);
     // biome-ignore lint/suspicious/noExplicitAny: test-only projection over dynamic row shapes.
     const project = (row: any) =>
-      row == null ? row : { ...row, [derivedColumn]: row[statusField] };
+      row == null
+        ? row
+        : // Honor an explicitly-seeded `derived_status` so a test can model the ADR-0065 divergence a
+          // real terminated instance produces — the base `<statusField>` frozen at its last transient
+          // while the derive edge reports the terminal (`abandoned`/`failed`/`reviewed`). When a row
+          // seeds no derived column the VIEW's `ELSE base.<statusField>` fall-through applies, so it
+          // stays byte-for-byte the pass-through the previous behaviour modelled.
+          {
+            ...row,
+            [derivedColumn]: row[derivedColumn] ?? row[statusField],
+          };
     // biome-ignore lint/suspicious/noExplicitAny: test-only Proxy over a dynamic DataLayer table.
     return new Proxy(inner, {
       get(target: any, prop: string) {